CVE-2026-93990
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.
Risk Assessment
This may lead to injection of malicious XML, potentially resulting in code execution or data disclosure.
Recommendation
Update Expat to version 2.8.5 or later. Avoid processing untrusted XML data in UTF-16 format.
Other vulnerabilities in Expat
See all- CVE-2016-4472High
The overflow protection in Expat is removed by compilers with certain optimization settings, allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data.
- CVE-2016-0718Critical
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
- CVE-2009-3720Medium
The updatePosition function in libexpat (Expat 2.0.1) has a buffer over-read vulnerability. Crafted UTF-8 sequences in an XML document can cause an application crash.
- CVE-2026-76641High
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.
- CVE-2026-66046High
Denial of service vulnerability in Expat through 2.8.3. The storeAtts() function in xmlparse.c has quadratic complexity, causing excessive CPU consumption when processing an XML document with many attributes with non-normalized values.
Original NVD description (English source)
Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS